fix: マネージャー各画面のリクエスト/セッション処理統一・TinyMCE7 CSS対応・bkmanager改善

assets/plugins/tinymce7/src/TinyMCE7/Editor/EditorInitializer.php

@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace TinyMCE7\Editor;
@@ -96,6 +97,8 @@ public function handle($event): void
         $config = $this->preferences->applyMenubarPreference($config);
         $config = $this->preferences->applyEnterMode($config);
 
+        $config = $this->applyEditorCssPath($config);
+
         [$config, $fileBrowser] = $this->fileBrowserResolver->resolve($config, $params);
 
         $configJson = $this->configRepository->encode($config);
@@ -148,4 +151,73 @@ public function handle($event): void
 
         $event->output(implode("\n", $output));
     }
+
+    private function applyEditorCssPath(array $config): array
+    {
+        if (!function_exists('evo')) {
+            return $config;
+        }
+
+        $editorCssPath = (string)evo()->config('editor_css_path', '');
+        if ($editorCssPath === '') {
+            return $config;
+        }
+
+        if (str_starts_with($editorCssPath, '/') || preg_match('@^https?://@', $editorCssPath)) {
+            $cssUrl = $editorCssPath;
+        } else {
+            $cssUrl = defined('MODX_BASE_URL') ? MODX_BASE_URL . $editorCssPath : '/' . $editorCssPath;
+        }
+
+        $cssUrl = $this->appendEditorCssVersion($cssUrl, $editorCssPath);
+
+        $existing = $config['content_css'] ?? [];
+        if ($existing === false || $existing === '' || $existing === null) {
+            $config['content_css'] = $cssUrl;
+        } elseif (is_array($existing)) {
+            $existing[] = $cssUrl;
+            $config['content_css'] = $existing;
+        } else {
+            $config['content_css'] = [(string)$existing, $cssUrl];
+        }
+
+        return $config;
+    }
+
+    private function appendEditorCssVersion(string $cssUrl, string $editorCssPath): string
+    {
+        if (preg_match('@^https?://@', $editorCssPath)) {
+            return $cssUrl;
+        }
+
+        $queryString = parse_url($cssUrl, PHP_URL_QUERY);
+        if (is_string($queryString)) {
+            parse_str($queryString, $queryParams);
+            if (isset($queryParams['v'])) {
+                return $cssUrl;
+            }
+        }
+
+        $pathPart = parse_url($editorCssPath, PHP_URL_PATH);
+        if (!is_string($pathPart) || $pathPart === '') {
+            $pathPart = $editorCssPath;
+        }
+
+        $localPath = defined('MODX_BASE_PATH')
+            ? MODX_BASE_PATH . ltrim($pathPart, '/')
+            : ltrim($pathPart, '/');
+
+        if (!is_file($localPath)) {
+            return $cssUrl;
+        }
+
+        $mtime = filemtime($localPath);
+        if ($mtime === false) {
+            return $cssUrl;
+        }
+
+        $separator = str_contains($cssUrl, '?') ? '&' : '?';
+
+        return $cssUrl . $separator . 'v=' . $mtime;
+    }
 }

manager/actions/element/mutate_template_tv_rank.dynamic.php

@@ -7,21 +7,21 @@
     alert()->dumpError();
 }
 
-if (!is_numeric($_REQUEST['id'])) {
+if (!is_numeric(anyv('id'))) {
     echo 'Template ID is NaN';
     exit;
 }
-$id = intval($_REQUEST['id']);
+$id = intval(anyv('id'));
 
 $basePath = $modx->config['base_path'];
 $siteURL = MODX_SITE_URL;
 
 $updateMsg = '';
 
-if (isset($_POST['listSubmitted'])) {
+if (postv('listSubmitted')) {
     $updateMsg .= '<span class="success" id="updated">Updated!<br /><br /></span>';
     foreach ($_POST as $listName => $listValue) {
-        if ($listName === 'listSubmitted') {
+        if ($listName === 'listSubmitted' || $listName === 'csrf_token') {
             continue;
         }
         $orderArray = explode(';', rtrim($listValue, ';'));
@@ -155,5 +155,9 @@
 </div>
 <form action="" method="post" name="sortableListForm" style="display: none;">
             <input type="hidden" name="listSubmitted" value="true" />
-            <input type="hidden" id="list" name="list" value="" />
+            <input type="hidden" id="list" name="list" value="" />';
+
+echo csrfTokenField();
+
+echo '
 </form>';

manager/actions/main/welcome.static.php

@@ -46,8 +46,8 @@ function hideConfigCheckWarning(key){
 // setup message info
 if (evo()->hasPermission('messages')) {
     $messages = manager()->getMessageCount();
-    $_SESSION['nrtotalmessages'] = $messages['total'];
-    $_SESSION['nrnewmessages'] = $messages['new'];
+    sessionv('*nrtotalmessages', $messages['total']);
+    sessionv('*nrnewmessages', $messages['new']);
 
     $msg = '<a href="index.php?a=10"><img src="' . $_style['icons_mail_large'] . '" /></a>
     <span class="inbox-title">&nbsp;' . $_lang["inbox"] . (sessionv('nrnewmessages') > 0 ? " (<span class='message-count-new'>" . sessionv('nrnewmessages') . '</span>)' : '') . '</span><br />';
@@ -194,7 +194,8 @@ function hideConfigCheckWarning(key){
 $modx->setPlaceholder('Modules', $modules);
 
 // do some config checks
-if (config('warning_visibility' == 0 && manager()->isAdmin())
+if (
+    config('warning_visibility' == 0 && manager()->isAdmin())
     || (config('warning_visibility') == 2 && evo()->hasPermission('save_role') == 1)
     || config('warning_visibility') == 1
 ) {